# The Linux Virus Writing HOWTO

## post link-time code modification of ELF executables under Linux/i386

### Alexander Bartolich

alexander.bartolich@gmx.at

Copyright © 2002 by Alexander Bartolich

Revision History
Revision A doomed ship should sail under a courageous flag. | 2002-04-13 |
Changed license, title, stylesheet and some SGML-tags. Finished Doing it in C.
Revision Sinners can repent, but stupid is forever. | 2002-04-09 |
Revision Deliver yesterday, code today, think tomorrow. | 2002-04-06 |
Revision Be different: conform. | 2002-04-01 |
Revision As a computer, I find your faith in technology amusing. | 2002-03-28 |
Revision Caution: Keep out of reach of children. | 2002-03-24 |
Revision Calm down, it's *only* ones and zeroes. | 2002-03-20 |
Revision What we do not understand we do not possess. | 2002-03-19 |
Revision What we do not understand we do not possess. | 2002-03-17 |
Revision I predict that today will be remembered until tomorrow. | 2002-03-15 |
Revision Genie escaped the bottle. | 2002-03-14 |
Revision Unfinished excerpt sent to David C. Merrill. | 2002-03-11 |
Revision Unfinished excerpt sent to Linux Documentation Project. | 2002-03-09 |

This document describes how to write parasitic file viruses infecting ELF executables on Linux/i386. Though it contains a lot of source code, no actual virus is included. Every mentioned infection method is accompanied with a practical guide to detection.

|  | Next
|  | Introduction